General
-
Target
PURCHASE ORDER-890003.exe
-
Size
833KB
-
Sample
210722-vdljcgjc1s
-
MD5
a72443c2ed0344ee479b1ab6f5ad151b
-
SHA1
a9801f7b05736f67d75f1e78bc0957fd32c439ca
-
SHA256
2d858522bfce2071f029aa5afea4dbaea3dafbfc4ae140671ffdba3bfa5cf82e
-
SHA512
1f5b6d1c4eef27ab969a307f128a855df0c28be1061b4a9fc7127b41f715f019d2832ecaf00ed3725a158acfae1ab0587507e3d05a881ea1d6744805cd3249e3
Static task
static1
Behavioral task
behavioral1
Sample
PURCHASE ORDER-890003.exe
Resource
win7v20210408
Behavioral task
behavioral2
Sample
PURCHASE ORDER-890003.exe
Resource
win10v20210410
Malware Config
Extracted
agenttesla
Protocol: smtp- Host:
mail.scottbyscott.com - Port:
587 - Username:
ideshow@eflownutrition.com - Password:
ngozi8989
Targets
-
-
Target
PURCHASE ORDER-890003.exe
-
Size
833KB
-
MD5
a72443c2ed0344ee479b1ab6f5ad151b
-
SHA1
a9801f7b05736f67d75f1e78bc0957fd32c439ca
-
SHA256
2d858522bfce2071f029aa5afea4dbaea3dafbfc4ae140671ffdba3bfa5cf82e
-
SHA512
1f5b6d1c4eef27ab969a307f128a855df0c28be1061b4a9fc7127b41f715f019d2832ecaf00ed3725a158acfae1ab0587507e3d05a881ea1d6744805cd3249e3
Score10/10-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
AgentTesla Payload
-
Suspicious use of SetThreadContext
-